diff options
| author | Asmaa Mnebhi <asmaa@nvidia.com> | 2022-09-08 13:35:39 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-09-28 11:10:40 +0200 |
| commit | 48ee0a864d1af02eea98fc825cc230d61517a71e (patch) | |
| tree | 87d332c22d04f849126cc2d30e50b2de3746da87 | |
| parent | 4f6db1f9219e8b122da64342b7daaf12eb8e8de2 (diff) | |
i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
[ Upstream commit de24aceb07d426b6f1c59f33889d6a964770547b ]
memcpy() is called in a loop while 'operation->length' upper bound
is not checked and 'data_idx' also increments.
Fixes: b5b5b32081cd206b ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC")
Reviewed-by: Khalil Blaiech <kblaiech@nvidia.com>
Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/i2c/busses/i2c-mlxbf.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/i2c/busses/i2c-mlxbf.c b/drivers/i2c/busses/i2c-mlxbf.c index 042c83b90734..d78fb24d5588 100644 --- a/drivers/i2c/busses/i2c-mlxbf.c +++ b/drivers/i2c/busses/i2c-mlxbf.c @@ -744,6 +744,9 @@ mlxbf_i2c_smbus_start_transaction(struct mlxbf_i2c_priv *priv, if (flags & MLXBF_I2C_F_WRITE) { write_en = 1; write_len += operation->length; + if (data_idx + operation->length > + MLXBF_I2C_MASTER_DATA_DESC_SIZE) + return -ENOBUFS; memcpy(data_desc + data_idx, operation->buffer, operation->length); data_idx += operation->length; |